refactor(cli): generate contracts with @cartesi/wagmi-plugin

[brunomenezes]

Summary

Replaces @sunodo/wagmi-plugin-hardhat-deploy + the @cartesi/devnet package with @cartesi/wagmi-plugin from the rollups-ts repository, and updates the call sites that the newer contract releases broke.

import { prtInternals, rollupsContracts } from "@cartesi/wagmi-plugin";
import { defineConfig } from "@wagmi/cli";

export default defineConfig({
    out: "src/contracts.ts",
    plugins: [rollupsContracts({ prt: true, exclude: prtInternals })],
});

apps/cli no longer depends on @cartesi/devnet at all. prt: true pulls the PRT contracts from the dave release alongside the rollups ones, so a single plugin call covers both.

Changes

file	change
apps/cli/wagmi.config.ts	hardhatDeploy({ directory: … }) → rollupsContracts({ prt: true, exclude: prtInternals })
apps/cli/package.json	drop @cartesi/devnet and @sunodo/wagmi-plugin-hardhat-deploy, add @cartesi/wagmi-plugin@1.0.0-alpha.7
apps/cli/src/base.ts	surface three contracts the new codegen provides in cartesi address-book
apps/cli/src/commands/deposit/{erc20,erc721,erc1155}.ts	use the renamed portal deposit functions
apps/cli/src/validations.ts	probe portals with version, and pass the widened calculateDaveAppAddress arguments
apps/cli/tests/unit/validations.test.ts	assert the probed function names so a future rename fails the suite

@cartesi/wagmi-plugin is pinned exactly, as @cartesi/devnet was — the plugin version determines codegen output. 1.0.0-alpha.7 is the newest published version; it defaults to rollups-contracts v3.0.0-alpha.10 and dave v3.0.0-alpha.5, and reads each release's anvil tarball as well, so chain 31337 is covered out of the box.

Address book additions

Three contracts the release now provides are added to cartesi address-book:

entry	where	notes
TestUsdc	devnet only	a devnet test token, alongside the existing TestToken / TestNFT / TestMultiToken
RefundOutputBuilder	devnet and live chains	added to rollups-contracts after alpha.6, so @cartesi/devnet never had it
UsdWithdrawalOutputBuilderFactory	devnet and live chains	already generated before, just never surfaced — it is the factory behind the existing TestUsdWithdrawalOutputBuilder entry

Only five contracts are genuinely devnet-only: TestFungibleToken, TestMultiToken, TestNonFungibleToken, TestUsdc and TestUsdWithdrawalOutputBuilder. The other two above are deployed at the same address on all nine chains, which is why they go in commonContracts.

This changes cartesi address-book output: 14 devnet rows become 17, and the fork output gains 2.

Merge blocker: the SDK image

One blocker remains, and the version half of it is now settled.

Codegen emits rollups-contracts alpha.10 / dave alpha.5 addresses. The devnet Anvil state the CLI talks to is baked into the SDK image, and the currently pinned 0.12.0-alpha.41 still carries dave alpha.3 / rollups-contracts alpha.6 — so cartesi run on devnet would talk to addresses holding no code.

#515 is the other half: it moves the SDK image off @cartesi/devnet too, pulling anvil_state.json straight from the dave release, and it stops shipping /usr/share/cartesi/deployments and printing the address list from the devnet script — "use cartesi address-book". It now pins CARTESI_PRT_VERSION = 3.0.0-alpha.5 and FOUNDRY_VERSION = 1.5.1, matching this PR's codegen exactly.

So the two must land together, with DEFAULT_SDK_VERSION in src/config.ts bumped to the resulting image. Dave alpha.5 pairing correctly with rollups-contracts alpha.10 is already confirmed: the two releases agree on all 122 shared (chain, contract) address pairs, which is also what the plugin's own cross-check enforces at codegen time.

Worth knowing: after #515, this generated file is the only place devnet addresses are printed, so a codegen mistake is no longer cross-checkable at runtime.

Checklist before merge

• Call sites updated for the renamed/removed contract functions, verified against real bytecode
• bun run build --filter @cartesi/cli clean
• bun test apps/cli/tests/unit/ green (132 pass)
• bun lint clean
• Confirm dave v3.0.0-alpha.5 is built against rollups-contracts v3.0.0-alpha.10 — 122/122 shared addresses agree
• #515 merges and an SDK image ships
• Bump DEFAULT_SDK_VERSION in apps/cli/src/config.ts to that image
• Smoke test against it: cartesi run, cartesi address-book (devnet and --fork, checking the three new entries resolve), cartesi run --prt, cartesi deposit erc20 against TestFungibleToken

Follow-up (separate PRs)

• Once this and feat(sdk): Prepare next rollups-node and remove devnet dependency #515 are both in, nothing consumes packages/devnet any more. It can be deleted outright, along with .github/workflows/devnet.yaml, its workspace entry, and its row in CLAUDE.md. That is the endpoint this branch is named for.
• There is no tsc in any script, turbo task or workflow — build is bun build, lint is biome, test is bun test, all transpile-only. That is precisely why the broken call sites above went unnoticed. Wiring up a typecheck gate is worth doing, but it first needs the 11 pre-existing errors in tests/unit/compose/builder.test.ts triaged (Config.name required but absent from fixtures; Model missing image / backend), which are unrelated to this change.
• .github/workflows/cli.yaml still installs Foundry v1.4.3, which existed for the @cartesi/devnet build. apps/cli no longer depends on that package, so the step is likely dead — worth checking against the integration tests before removing it.

Notes for reviewers

• Codegen now needs network access. The plugin downloads and hash-verifies up to six tarballs (artifacts, deployment addresses and anvil state, for both rollups-contracts and dave) on every run, keeping nothing between runs by design. Offline builds of apps/cli will fail; CI is unaffected.

[changeset-bot]

🦋 Changeset detected

Latest commit: 7cccaf1

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@cartesi/cli	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​cartesi/​wagmi-plugin@​1.0.0-alpha.7
	modern-tar@​0.7.7

View full report

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🟢	Lines	99.36% (🎯 0%)	10518 / 10586
🔵	Statements	99.36%	10518 / 10586
🔵	Functions	94.89%	130 / 137
🔵	Branches	0%	0 / 0

📁 File Coverage (19 files)

File	Lines	Statements	Functions	Branches	Uncovered Lines
apps/cli/src/builder/directory.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-
apps/cli/src/builder/docker.ts	🟢 86.72%	🟢 86.72%	🟡 66.67%	🔴 0%	75-77, 79, 109-111, 169-178
apps/cli/src/builder/empty.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-
apps/cli/src/builder/none.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-
apps/cli/src/builder/tar.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-
apps/cli/src/compose/builder.ts	🟢 99.79%	🟢 99.79%	🟢 100%	🔴 0%	228
apps/cli/src/compose/common.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-
apps/cli/src/compose/node.ts	🟢 99.24%	🟢 99.24%	🟢 100%	🔴 0%	106
apps/cli/src/config.ts	🟢 94.32%	🟢 94.32%	🟢 95.24%	🔴 0%	75-76, 251, 260, 269, 363, ...
apps/cli/src/contracts.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-
...rc/errors/ForkChainValidationError.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-
...c/errors/UnsupportedForkChainError.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-
...c/exec/cartesi-machine-stored-hash.ts	🟢 92.86%	🟢 92.86%	🟢 100%	🔴 0%	36-37
apps/cli/src/exec/cartesi-machine.ts	🟡 75%	🟡 75%	🟡 66.67%	🔴 0%	10-12, 28-30
apps/cli/src/exec/genext2fs.ts	🟢 96.92%	🟢 96.92%	🟢 100%	🔴 0%	87-88
apps/cli/src/exec/index.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-
apps/cli/src/exec/mksquashfs.ts	🟢 91.53%	🟢 91.53%	🟢 100%	🔴 0%	70-74
apps/cli/src/exec/util.ts	🟢 85.11%	🟢 85.11%	🟡 66.67%	🔴 0%	24-28, 68-69
apps/cli/src/validations.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-

[brunomenezes]

I will be closing in favour of #529. I fold all the changes here onto #529 to align and simplify the PRs.